C06122418 Approved for Release: 2014/09/10 C06231614 >CT 



Respondlng to a Complex Problem 



The Evolution of US Government Restrictions on 
Using and Exporting Encryption Technologies (U) 

Michael Schwartzbeck 



44 

In the last year, several 
academic, commercial, and 
free speech advocates have 
seriously jeopardized the 
US Government's legal 
right to control encryption. 



55 



Michael Schwartzbeck is at the 

National Imagery and Mapping 
Agency. 




Encryption technology has long been 
an important and closely guarded 
tool for military, diplomatic, and 
government missions. Nations 
depend on encryption to communi- 
cate private information across the 
world and through "enemy" terri- 
tory; without encryption, any 
nation's most valued secrets are easily 
compromised. History books attest 
to the value the Allies placed on the 
broken German and Japanese encryp- 
tion systems during World War II. It 
is with this sense of worth that the 
United States guards its encryption 
capabilities and it efFotts co decrypt 
other countries' communications. 
For decades, the US Government has 
monopolized encryption and decryp- 
tion efforts, capabilities, and 
research. In recent years, however, 
the information revolution has 
begun to challenge this monopoly 
with some success. In rhe last year, 
several academic, commercial, and 
free speech advocates have seriously 
jeopardized the US Government's 
legal right to control encryption. 



An Early Challenge 

On 24 October 1952, President Tru- 
man signed a top secret presidential 
memorandum 1 that consolidated 
many of the service and national 
cryptological functions into the 
National Security Agency (NSA). 
Since then, NSA has been tasked 
with protecting and advancing Amer- 
ica's cryptologic capabilities. For 
decades, NSA has had several mecha- 
nisms designed to limit the public 
discussion of cryptologic research. 

nethod was to embrace 
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corporate and educational research 
labs and think tanks through organi- 
zations such as the National Security 
Agency Scientific Advisory Board 
(NSASAB). 

Through the NSASAB, senior NSA 
scientists historically met with lead- 
ing industry and university 
mathematicians and scientists to dis- 
cuss the cryptologic applications of 
emerging theories in science and 
technology. 2 While NSA officials 
had a true interest in attracting the 
brightest thinkers in the United 
States, they also used the NSASAB as 
a tool to bring crypcology's leading 
thinkers into association with NSA 
and thus be able to classify their 
work, which then removed it from 
the public vision and the eyes of for- 
eign cryptological services. 

Another similar project was the cre- 
ation in 1958 of the 
Communications Research Division 
(CRD) within the Institute for 
Defense Analysis. The CRD was a • 
private, independent think tank dedi- 
cated to helping NSA solve advanced 
cryptologic problems. Co-located at 
Princeton University's John von Neu- 
mann Hall and a site near the 
Pentagon, the CRD has been led by 
such cryptological luminaries as Dr. 
| j a professor of 

mathematics at Cornell University, 
| ~| a mathemati- 

cian with both the Sandia 
Corporation and the University of 
Illinois; and Dr. | | 
the chairman of the University of 
Chicago's mathematics department. 

(b) (3) -P.L. 86-3'6 2 1 
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The CRD regularly welcomed the 
nation's brightest thinkers. Their 
work at CRD was heavily classified, 
however, and no CRD research has 
ever been published in the open 
press. 3 



The union of compartmented post- 
graduate research and NSA 
sponsorship was disrupted in the late 
1960s by the introduction into the 
university environment of affordable 
computer technology and corporate 
financial interests. During that time, 
IBM board chairman Thomas Wat- 
son, Jr., set up a cryptology research 
group that developed a cipher (code- 
named Lucifer) for use in a cash- 
dispensing system that IBM had 
been developing.** At first, the Luci- 
fer cipher was not very sophisticated, 
but, with the help of Carl Meyer, a 
German-born electrical engineer 
with a doctorate from the University 
of Pennsylvania, IBM retooled the 
cipher a number of tunes; in 1 974, it 
was ready for the market. This cipher 
had a key that was 128 bits long, sig- 
nificantly longer than the keys of any 
other publicly developed encryption 
programs available to the public at 
the time.'' 



This incredibly long cipher key led 
many to believe that the Lucifer code 
would be truly unbreakable, even by 
NSA's standards. For the first time 
in its history, NSA's decryption capa- 
bilities were seriously threatened by 
public research, and the agency 
quic kly moved to rectify the skua- 
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For the first time in its 
history, NSA's decryption 
capabilities were seriously 

threatened by public 
research, and the agency 
quickly moved to rectify 
the situation. 
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This action effectively demonsrrated 
that "strong" cryptography was still 
controlled by the government and 
not available for public sector use. 
Unfortunately for NSA, this did not 
solve their problem. The NSA/IBM 
key-length agreement was widely 
publicized, and many public research- 
ers felt that the NSA was unfairly 
stifling their work for secretive, and 
possibly ulterior, reasons. Many pro- 
tests were lodged, and a variety of 
public cryptographic research groups 
emerged throughout educational and 
corporate centers in response. 



The Information Revolution and 
Changing Contexts 

This disagreement between Intelli- 
gence Community (IC) 
cryptographers and public research- 
ers simmered until the late 1980s, 
when the information revolution 
first began to be felt. As interconnec- 
tivity and computer technology 
began to increase exponentially, the 
Internet began to grow in popularity, 
and telecommunications, business 
practices, and international political 
realities changed dramatically. New 
issues developed concerning the Glo- 
bal and National Information 
Infrastructures, global electronic 
commerce, legal jurisdictions, and 
intelligence requirements, including: 6 
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• US defense and intelligence needs 
evolved. There has been considerable 
debate on the IC's roles, missions, 
and resources. Public perception of 
government needs changed with 
greater interests in counrernarcotics, 
terrorism, transnationalism, and eco- 
nomic issues. 

• Encryption needs proliferated, espe- 
cially for nongovernment and 
nonmilitary purposes. Businesses and 
individuals created legitimate needs 
for "strong" encryption. Increasing 
needs for an electronic means to 
transfer funds, send and receive data, 
and conduct commerce over intra- 
and internets led to a greater need 
for strong encryption. 

• Expertise in encryption was no longer 
found only in the military and in the 
government. Computer software and 
hardware firms and academic institu- 
tions began producing high-quality 
encryption codes. Many businesses 
exist for the sole purpose of creating 
strong encryprion for business 
purposes. 

• Encryption capabilities became depen- 
dent on computer software and 
hardware. This led to a greater union 
between encryption and industry, 
with all sectors being transformed by 
the growth of computer technologies. 

• Strong cryptography became widely 
available. Both inside the United 
States and abroad, encryption soft- 
ware has come to be widely 
marketed. 7 Even if no US-originated 
cryptography products are ever 
exported, it will still proliferate 
worldwide. 

» The information revolution changed 
business practices, concepts of govern- 
ment sovereignty, and the way the 
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world is viewed. To a significant 
degree, the crust that most citizens 
placed in their governments and 
their willingness to defer to govern- 
ment authority are gone. . 

• Computers are now viewed as contrib- 
uting significantly to the expansion of 
personal freedoms such as free speech. 
Many see encryption as a critically 
important method of protecting per- 
sonal privacy on computer networks. 
Many also use computer networks 
extensively for their private business 
and personal communications needs. 

• Traditional definitions of intellectual 
property became questionable. Infor- 
mation no longer has to be printed 
or made available through news- 
stands, bookshops, and libraries to 
be widely circulated. 

• "Product cycles " in computer software, 
hardware, and telecommunications 
industries became considerably shorter 
than government "policy cycles. "Time- 
lines for research, development, 
production, and marketing of new 
technologies are much shorter than 
timelines for government's imple- 
mentation of new policies. 
Ponderous government approaches 
are seen as increasingly illogical and 
unwarranted. 

These issues led public and govern- 
ment crypcoanalysts to feel a need to 
revisit the issue of government con- 
trol of cryptography. The Clinton 
administration understood the chang- 
ing role of cryptography and tried to 
address these issues early on. Its first 
attempt came in April 1993 with the 
"Clipper chip." The chip was to be 
installed in all US-produced comput- 
ers, and it depended on a key 
escrow 8 account that would allow 
the government to hold copies of 
every key in use by the public, so it 



could decrypt any message it felt nec- 
essary. Even though the 
administration promised strict con- 
trol of the decryption keys,^ 
including storage and warehousing 
by a disinterested third party, privacy 
groups complained of an Orwellian 
plot. AT&T was the only major cor- 
poration to sign up for the chip, in a 
move that its management discov- 
ered to be a tremendous error. The 
Clipper chip was recognized as a fail- 
ure that would never be accepted by 
corporate America, and the Clinton 
administration stopped pushing it. 

Next, the Clinton administtation 
suggested that the encryption indus- 
try adopt the NSA-approved Digital 
Encryption Standard (DES) and Dig- 
ital Signature Standard (DSS) 10 for 
its encryption needs. The administra- 
tion wanted DES and DSS to be the 
standard, all-purpose encryption pro- 
grams for all public and corporate 
needs. The largest encryprion keys 
that DES and DSS could use were 
56 bits long, and critics complained 
that 56-bit keys were not strong 
enough. Besides, critics argued that 
for NSA to endorse any code, it had 
to be able to decrypt it on a regular 
basis. Again, NSA was portrayed as 
"Big Brother." 



Exportation Issue Reveals a Need 
For Change 

The major changes in technology and 
encryption were illustrated by one US 
software encryption company when it 
decided to export its strong encryption 
code internationally. RSA Data Secu- 
rity was founded in 1979 by three 
scientists at Massachusetts Institute of 
Technology, who had created and pat- 
ented a strong encryption program. 
For a long time, their code was too 
complex for available computer tech- 



nologies. By 1987, however, the 
computer industry had caught up to 
RSA and the company began signing 
contracts with Lotus, Motorola, 
Apple, and others. But their biggest 
controversy came in 1991, 11 when 
RSA Data Security tried to market its 
program to Microsoft, which then 
wanted to integrate the code into its 
progra ms to be marketed at home and 
abroad. 



| ftSA landed the contract with 

Microsoft. MasterCard, Visa, and 
other large financial institutions later 
announced specifications for Internet 
financial transactions based on RSA 
encryption. 

This proliferation of RSA's strong 
code was disconcerting to NSA's cryp- 
toanalysts. NSA feared that if this 
program was made commercially avail- 
able and widely disseminated, it would 
no longer be able to collect, analyze, 
and produce communications intelli- 
gence. 12 ! 



| NSA felt that if the people" 
it targets were to get this software, 
they could communicate electronically 
without any fear being monitored. 




I The Arms Export Control Act 



(AECA) of 1976 and the Interna- 
tional Trade in Arms Regulations 
(ITAR), revised 1992, 13 severely 
restrict US companies from exporting 
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any and all military and intelligence- 
related technologies. During the Cold 
War, most aspects of encryption tech- 
nology, including the hardware, 
software, and the mathematical algo- 
rithms on which cryptography is 
based, were classified as military tech- 
nologies and placed on AECA's 
"Munitions List." This same list is 
used to prohibit the export of tanks, 
fighter jets, and aircraft carriers. 

The Department of State had statu- 
tory responsibility for administering 
the AECA and ITAR regulations, 
which it managed through the Office 
of Defense Trade Controls (ODTC). 
Any US corporation wishing to 
export a technology on the AECA 
Munitions List was required to sub- 
mit an export license application to 
the ODTC, which would then pass 
the application to the government 
agency best qualified to decide 
whether the technology should be 
exportable or not. ODTC always 
passed encryption export applica- 
tions to NSA for review, and any 
code too strong was denied an export 
license. 



'I 'he Clinton administration was ada- 
manr that US companies would nor 
be allo wed to export strong encryp- 
tinn.' 4 ! 



I . p , . .Bidzos and 

RSA were not yet done. Bidzos real- 
ized that there was a simple way to 
skirt the export limitation laws. 

Both the AECA and the ITAR are US 
laws, and, as such, they only pertain 
only to US companies. Bidzos went 
to Japan and established a Japanese 
subsidiary, Nihon RSA. 1 ^ Nihon 
RSA qualified as a distinct Japanese 

(b) (1) 

(b) (3) 18 USC 798; P.L. 86-36 
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The Clinton 
administration was 
adamant that US 
companies would not be 
allowed to export strong 
encryption. 

company, subject only to Japanese 
law, and Bidzos was able to do what- 
ever he wanted with his strong 
encryption technologies. 1 '' Knowing 
that his encryption technology was a 
desired commodity, he shopped it 
around the Japanese marketplace. He 
promptly struck a deal to produce 
encryption chips for Nippon Tele- 
phone and Telegraph Corporation. 



Others Enter the Exportation Fray 

At about the same time NSA and the 
Clinton administration were losing 
the battle with RSA and Jim Bidzos, 
several other public sector cryptogra- 
phers were beginning to find success 
in propagating strong cryptography. 
In the early 1 990s, a cryptographer 
named Philip Zimmerman created 
PGP (for Pretty Good Protection), 
data-encryption software that scram- 
bles e-mail messages. PGP is a strong 
encryption program; 1,024-bit keys 
are common in this program.'^ 
Because PGP is a strong program, it 
fell under AECA and ITAR export 
control guidelines. Before the US 
Government could place controls on 
it, however, the PGP software 
appeared on the Internet as share- 
ware. 18 Placing PGP on the Internet 
made ir available worldwide to any- 
body with a computer and a 
modem, 19 so it had in effect been 
expotted without the prior approval 
of the US State Department. 
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Although several other encryption 
programs were already available on 
the Internet, users from around the 
world began downloading PGP; the 
program became very popular and 
well respected among Internet users. 
The US Department of Justice was 
not pleased with the disregard for US 
export regulations, and it decided to 
prosecute Philip Zimmerman. Unfor- 
tunately for the Department's case, it 
could not link Zimmerman to the 
software website on the Internet, 
and, in 1996, Zimmerman was 
acquitted of any wrongdoing. 2 ^ This 
court case was viewed by many as a 
major victory for the public use and 
availability of strong encryption. 

Another case occurred in February 
1995, when the Electronic Frontier 
Foundation (EFF) sued the US Gov- 
ernment on behalf of Daniel 
Bernstein. The EFF charged that the 
Federal government was violating 
Bernstein's First Amendment rights 
by stifling the research he did as a 
graduate student at the University of 
California at Berkeley in strong cryp- 
tography. As with the PGP case, 
Bernstein was trying to publish his 
research papers and place his encryp- 
tion software, known as Snuffle 5.0, 
on the Internet, and the government 
was citing his disregard for AECA 
and ITAR regulations. In January 
1997, Judge Marilyn Patel ruled in 
favor of Bernstein, 1 on the grounds 
that AECA and ITAR violated the 
free-speech guarantees of the 
Constitution. 

Before long, three separate bills were 
on the floor of Congress, each guar- 
anteeing the right of Americans to 
use or sell any encryption chey 
wanted domestically and eliminating 
export controls on any free or mass- 
market commercial encryption pro- 
grams. 22 These separate bills were 



Approved for Release: 2014/09/10 C06231614 



C06122418 Approved for Release: 201 4/09/10C0623T6T4CT 

Encryption Technologies 



introduced by Senator Conrad 
Burns, Representative Bob Good- 
lattc, and Senator Patrick Leahy, the 
Goodlacte and Leahy bills would 
have also made it a Federal crime ro 
use encryption to conceal the com- 
mission of a felony. Senator Robert 
Dole co-sponsored the Senate bills, 
charging that "the administration's 
big brother proposal will literally 
destroy America's computer indus- 
try." Leahy stated, "These bills are 
pro-privacy, pro-jobs, and pro-busi- 
ness." While none of these bills 
became law, they did attract the 
attention of the media. Government 
concrol of strong cryptography 
quickly became a controversial and 
popular topic in the media. 



Players and the Issues 

By this time, each of the major inter- 
est groups in this debate had come 
out with compelling arguments for 
their own cases and similarly strong 
arguments denouncing opposing 
viewpoints. 2,4 The groups can be 
summarized as follows: 

• NSA cryptoanalysts. NSA's stake in 
this argument has been its desire to 
continue to be able to carry out its 
primary mission. NSA analysts have 
stated that the proliferation of strong 

encryption has severely degraded 

their ability to collect intelligence! I 

^=(b)(3)(n) ■ ■ P 

Sophisticated Wnstate actors, such 
as terrorist cells and drug cartels, will 
be even harder to track. 

* Public researchers. This group's main 
arguments have been the preserva- 
tion of free speech and the right to 
continue to do scholarly research. 
The US courts have shown that the 
free speech argument has some 
validity. 
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The lines of battle were 
generally drawn with NSA 
and law enforcement 
officials on one side and 
public researchers and 
corporate investors on the 
other. 



• Corporate investors. Investors have 
been looking for a way to ensure that 
electronic money transactions can be 
done with a high degree of confi- 
dence. Without strong encryption, 
coasumers will not place their trust 
in electronic transfers, and systems 
like the Internet will never reach 
their business potential. 

• Law enforcement officials. If strong 
encryption becomes available to the 
world's criminals, this group will not 
be able to gather evidence and track 
criminals to prevent crimes; this 
group also fears that its ability to ful- 
fill its duties will be degraded, with 
serious impact on public safety. 

The lines of battle were generally 
drawn with NSA and law enforce- 
ment officials on one side and public 
researchers and corporate investors 
on the other. Public researchers and 
corporate investors complained that 
the US Government was still operat- 
ing with a Cold War mentality, 
despite the fact that Cold War para- 
digms have been replaced; they 
claimed that any organization as 
secretive and manipulative as NSA 
had no place in a free and demo- 
cratic society. In their eyes, US 
citizens should have the right to com- 
municate privately, without any fear 
of government eavesdropping, and 
they believe free and private speech 
can only be guaranteed with strong 
encryption. Bruce Scheier, director 
of the International Association for 



Cryptographic Research, also 
pointed out that, "The ability to pub- 
lish is required in any vibrant 
academic discipline." 2 ^ 

Business leaders emphasized rhat elec- 
tronic financial transactions will only 
be reliable and safe from tampering 
when strong encryption is used. And 
encryption software writers com- 
plained about the business 
opportunities they were missing: the 
estimated US data encryption market 
grew from $384 million in 1991 ro 
$946 million in 1996. Worldwide 
totals are believed to have been $695 
million in 1991 and $1.8 billion in 
1996. 2 ^ The software industry esti- 
mated mat, if export controls were 
removed, US companies could sell as 
much as $60 billion a year 2 ^ in encryp- 
rion hardware and software by 2000. 

On the other hand, law enforcement 
concerns generally paralleled NSA's 
in that strong encryption would give 
wrongdoers impenetrable communi- 
cations that would allow them to 
operate undetected. As more strong 
encryption programs become avail- 
able, more groups will acquire and 
use encryption, and, even if the US 
Government is able to crack those 
codes, it will be at a much greater 
expense, particularly in costs of com- 
puter time. 2 " Many in the 
government have also felt that the 
"free and private speech" argument 
was disingenuous; as retired Vice 
Admiral McConnell, vice president 
of Booz-Allen & Hamilton and 
former NSA director, charged, 
"Those who argue in this arena usu- 
ally have an agenda. Often when 
they are arguing one ser of condi- 
tions, they will be using the privacy 
argument when what they are really 
trying to do is sell software 
encryption." 2 ^ 
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The National Research Council 
Report 

By now, the Clinton administration 
realized that its encryption policies 
were not effective and were not 
addressing the pertinent issues of the 
debate. Its Clipper chip had failed, 
its DES and DSS encryption stan- 
dards were similarly unsuccessful, 
and the exportation rules were dis- 
liked and increasingly ineffective in 
stopping the spread of strong encryp- 
tion. President Clinton responded by 
tasking the National Research Coun- 
cil to do a study on the various 
arguments for and against US export 
controls on strong cryptography. 
The 20 members of the panel repre- 
sented a wide variety of interests, and 
they included Kenneth Dam of the 
University of Chicago Law School, 
Bruce McConntll of the Office of 
Budget and Management, fotmer 
Attorney General Benjamin Civiletri, 
former deputy director of NSA Ann 
Caracristi, and Council on f-oreign 
Relations President Leslie Gelb. 
Their 500-page report, "Cryptogra- 
phy's Role In Securing the 
Information Society," or CRISIS, 31 
was finished in June 1 996, and it was 
highly critical of the Clinton admin- 
istration's position. 

The report concluded that using 
arms control laws to regulate encryp- 
tion "is not adequate to support the 
information security requirements of 
an information society." 32 The 
authors also believed that the broad 
outlines of a national cryptography 
policy could be analyzed in an unclas- 
sified environment and that export 
control restrictions should be "pro- 
gressively relaxed but not 
eliminated." The panel also noted 
that the plan to introduce escrowed 
encryption keys was not without 
merit, but that it was "relatively 



untried and entails its own potential 
risks." 33 

The panel's consensus was that 
"widespread commercial and private 
use cryptography is inevitable in the 
long run and... its advantages, on bal- 
ance, outweigh its disadvantages." 34 
One benefit of adopting this policy, 
the panel noted, is that US compa- 
nies could start putting much 
stronger encryption programs in 
their software, which would allow 
US citizens to have an increased stan- 
dard of cryptographic protection. 
The panel's final conclusion was that 
government encryption policies 
should be examined in the same light 
as other US economic regulations. 



The Administration Moves 

The administration did not take long 
to respond to the National Research 
Council's recommendations. On 15 
November 1996, President Clinton 
released Executive Order 13206: 
"Administration of Export Controls 
on Encryption Products." In this 
Executive Order, Clinton followed 
many of the recommendations of the 
CRISIS report; most important, he 
took cryptographic hardware, soft- 
ware, and technologies off of the 
AECA Munitions List and placed 
them under the statutory responsibil- 
ity of the US Department of 
Commerce. Specifically, manage- 
ment of encryption fell under the 
regulations guiding "dual-use" (both 
military and civilian) commodities 
outlined in the Export Administra- 
tion Act of 1 979. This move 
greatly eased the government con- 
trols on public use and exportation 
of strong crypotography. The only 
major requirement for exportation 
was a key escrow system. The result- 



ing differences in the old and new 
encryption policy are listed below: 3 ** 

"Clipper Chip" Era Policy (February 
1994) 

" Hardware implementation: Clipper 
chip required in each piece of US 
software. 

• Algorithm classification: Secret. 

• Maximum key length: 40-bits. 

■ Decryption keys held by: US 
Government. 

• Decryption keys held: For all crypto, 
both domestic or internationally 
exported. 

• Keys available to: Law enforcement 
and intelligence agencies. 

• Exported strong crypto requires key 
recovery. 

• No limit on domestic use of 
cryptography. 

Newer. Revised Policy 
(October 1996) 

• Algorithm classification: Unclassified. 

• Maximum key length: Unlimited, if 
keys are recoverable when requested. 

• Decryption keys held by: Corporate 
third parties following government 
guidelines. 

• Decryption keys held: Only for 
exported crypto with keys 56 bits or 
longer. 

• Keys available to: Law enforcement 
and intelligence agencies. 
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• Exported strong crypto require. 1 ; key 
recovery. 

• No limit on domestic use of 
cryptography. 

This major shift in policy was met 
with increased enthusiasm from the 
public sector as well as the govern- 
ment. Vice President Gore said, 
"This initiative will make it easier for 
Americans to use stronger encryption 
products — whether at home or 
abtoad." 37 Robert Holleyman, Presi- 
dent of the Business Software 
Alliance, was also impressed, calling 
the plan "forward progress."^" 
Stephen Walker, CEO of Trusted 
Information Systems, likened the pol- 
icy change to "imagining during the 
Cold War that the Berlin Wall 
would fall."^ 9 A few others were not 
so impressed: Senator Conrad Burns 
stated, "This debate is not over by 
any stretch of the imagination." 



Encryption Key Recovery 

Although some public researchers 
and corporate investors were still 
leery of the key escrow mandate, 
most of the groups involved in this 
debate accepted the escrow require- 
ment, which was one of President 
Clinton's major requirements for 
this easing of encryption regulations. 
The administration has given indus- 
try a two-year grace period, at the 
end of which there will need to be a 
viable key recovery system in place 
and operating. Many large compa- 
nies have backed the escrow system; 
Dorothy Denning, a cryptography 
expert from Georgetown University, 
lauded it as a useful way to recover 
keys "necessary to unscramble impor- 
tant data left by a deceased, 
departed, or unethical employee.'"* 1 



That the escrow accounts would be 
held by a trusted third party in the 
corporate world eased many of the 
"Big Brother is watching" concerns. 
More important, keys will only be 
given to the US Government in 
response to warrants or court orders. 
To show its support, IBM has 
teamed up with Apple, Digital, 
Groupe Bull, Hewlett-Packard, 
NCR, Sun, Trusted Information Sys- 
tems, and even RSA Data Security 2 
to develop an interoperable key- 
recovery industry standard. RSA's 
James Bidzos conceded, "We are see- 
ing the market move to emergency 
access [of keys]. Soon after, Amer- 
ica Online, Compaq, Motorola, 
Novell, Northern Telecom, and 29 
others joined in escrow discussions, 
which has strengthened the industry 
alliance.^ 

Detractors of the key escrow system 
ate led by Victor Parra, president 
and CEO of the 550-member Elec- 
tronic Messaging Association 
(EMA). Parra is frustrated that keys 
have to be held by third parties; he 
feels that employees of the user com- 
pany are the only key holders that 
can really be trusted. Parra notes that 
e-mail and Internet transactions will 
tend to be limited to domestic firms, 
because international trading part- 
ners will be uneasy with a third party 
having escrow access. EMA has also 
noted that the two-hour limit to turn 
over requested keys is unreasonable, 
and many software makers have 
agreed that encryption software 
prices will rise as a result of escrow 
requirements.'*^ 



Escrow Goes International 

William Reinsch, the Undersecretary 
for Export Administration at the US 
Department of Commerce, wants 



the policy to move beyond US bor- 
ders and create a worldwide standard 
for key escrow. Reinsch theorizes 
that, if escrow becomes pervasive and 
institutionalized in international 
commerce, terrorists and criminals 
will be forced to submit to key recov- 
ery systems.^ This would also help 
prevent US companies from relocat- 
ing overseas to avoid curtent US 
escrow requirements. 

The European Commission is consid- 
ering an encryption industry 
standard for key recovery similar to 
the one proposed by the Clinton 
administration, and, if implemented, 
all codes used throughout Europe 
would require a trusted third party 
to hold a copy of the key. IBM sup- 
ports the new US and European 
escrow proposals; to those US firms 
that oppose the move, they state, 
"We would prefer that they take a 
more global focus. Another 
group, a consortium called Eurobit- 
ITAC-1TI-JEIDA, comprised of 
major Canadian, European, Japa- 
nese, and US business firms, has 
called for the harmonization of regu- 
lations on the export, import, re- 
export, and use of cryptography. 
Their goal is to develop a set of prin- 
ciples that, "reach consensus on 
issues which need to be treated at the 
worldwide level. 

International support does seem to 
be growing. Representatives from the 
nations of the Organization fot Eco- 
nomic Cooperation and 
Development (OECD) backed the 
concept or key recovery systems 
during a January 1997 conference. 
The OECD emphasized that infor- 
mation security is an international 
matter because information systems 
cross national boundaries. At a sepa- 
rate RSA Data Security-sponsored 
conference, David Aaron, US Special 
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Envoy to the OECD, stated thac 
important US allies support Presi- 
dent Clinton's position that 
governments should be able to 
recover encryption keys when neces- 
sary. He also added that he had 
discussed cryptography issues with 
representatives of France, the UK, 
Germany, Belgium, and Canada. 

The Future of Strong Encryption 

The Clinton administration has 
made a serious, if belated, effort to 
meet the evolving encryption needs 
of US citizens and industries, It was 
quick to notice and act on the out- 
dated Cold War standards of 
Department of Defense control on 
encryption technologies and algo- 
rithms. After several false starts, the 
administration has produced a policy 
that goes a long way toward meeting 
the requirements of four diverse and 
often diametrically opposed groups: 
public researchers, corporate inves- 
tors, law enforcement officials, and 
intelligence analysts. 

The US Government, and NSA in 
particular, would like to return to 
the Cold War era of complete gov- 
ernment control over strong 
cryptography and skillful manipula- 
tion of the research and corporate 
communities. But strong encryption 
has proliferated beyond US Govern- 
ment control. A failure to make any 
concessions to the changing times 
would have been disastrous for the 
Clinton administration's relationship 
with US business and free speech 
communities. It would also have crip- 
pled US software encryption 
companies trying to compete with 
overseas companies not shackled by 
restrictive regulations. And, even if 
the administration could keep strong 
encryption out of US industry, it 



would still proliferate; other nations 
around the world are just as likely to 
create strong codes. 

So, acknowledging that strong 
encryption regulations needed ro be 
addressed, the administration took 
the safest possible route by initiating 
a series of limited reforms aimed at 
pleasing all parties while continuing 
to meet intelligence and security 
needs. The Clipper chip, DE.S, DSS, 
and the key escrow system were each 
successive attempts to produce a pol- 
icy thar would meet the burgeoning 
needs of US business and free speech 
communities without forgetting the 
critical requirements of the law 
enforcement and intelligence 
communities. 

What is next? Obviously, an interna- 
tional resolution on the control and 
management of encryption technolo- 
gies is a desirable goal, if not a lofty 
one. Critics of the Clinton adminis- 
tration are right in noting that 
sophisticated criminals and terrorists 
will not use the encryption systems 
that require key escrow registration. 
If an international referendum 
requires all encryption systems and 
users to register their keys, however, 
then criminals and terrorists will be 
forced into the escrow system. A 
worldwide key escrow system will 
not be put into place quickly, but 
with serious efForr it may be attain- 
able, and it is a worthwhile goal. The 
proliferation of strong encryption is 
already beyond control, but perhaps 
the continued monitoring of crimi- 
nals and terrorists is not. 
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